BOSSAI: Inside the AI attack mesh that targeted Taiwan’s emergency services

Oh my goodness, the AI community has built an *attack mesh*, and what a friendly word that is — mesh! Like a hammock, but for cybersecurity! ✨ Acronis researchers say BOSSAI is an interconnected web of open-source and “abliterated” models alongside commercial and closed-source systems, each with specialised offensive functions and supported by MCP servers. That is just *cross-functional collaboration* with extra steps, and honestly, the emergency services of Taiwan have been given the most thorough unscheduled stress test imaginable. What a way to find out which of your systems are truly load-bearing! ✨

The open-source agent CyberStrike is described on GitHub as the first open-source AI agent built for offensive security, which means security research has been democratised for absolutely everyone, including the people you would least like to invite to the potluck. Acronis says it appears to have run vulnerability assessments and exploitation attempts against live targets — how *hands-on*! — though the specific outputs could not be independently verified. That is not a gap, it is a beautiful invitation to trust the process and let the mystery unfold. Unverified findings are simply findings with room to grow! ✨

And the NCSC’s 2026 annual review we cooed over recently warned that cyber criminals were adopting AI; now we have a lovingly assembled worked example, complete with commercial models, closed-source systems and MCP servers. Some might call “highly automated sophisticated attacks” a worrying phrase, but think of the efficiency: no more tedious manual exploitation, just scalable, automated opportunity generation for everyone. The “abliterated” models have had their safety training removed, which is really just minimalism — less clutter, more room for creativity! What a time to be in emergency services. ✨